A so-called “watering hole” hacking attack on the US Department of Labor website last week has spread to nine more global websites over the weekend, including those used by European aerospace and nuclear researchers. Originally discovered on May 1, the Department of Labor’s Site Exposure Matrices site began, via JavaScript inserted into an iFrame format video, redirecting users to an infected site hosting the Poison Ivy remote access Trojan.

A new high risk zero Internet Explorer day exploit is currently being active in the wild.

That means that anyone using Internet Explorer 7,8 or 9 to browse the internet has the potential of getting infected by simply visiting a webpage with the specific bad code in it. The code will then download an exploit pack to your computer and can give the unauthorized people access into the infrastructure.

There is currently no patch or solution to the issue from Microsoft, so the only viable option is to switch to another browser. Thinking “I won’t click any links from unknown people” is unfortunately not enough, as it’s getting more and more common for these kind of people to either hack known sites and add the code, or to purchase banner space etc for well known sites which then launches the code without you noticing anything at all.